Description
OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.3.3, if a request is made on an URI starting with //, coraza will set a wrong value in REQUEST_FILENAME. For example, if the URI //bar/uploads/foo.php?a=b is passed to coraza: , REQUEST_FILENAME will be set to /uploads/foo.php. This can lead to a rules bypass. This vulnerability is fixed in 3.3.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| corazawaf | coraza | < 3.3.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250327T184518-1.1 | openSUSE-SU-2025:14937-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/corazawaf/coraza | all versions | — | GO-2025-3537 |
| Go | github.com/corazawaf/coraza/v2 | all versions | — | GO-2025-3537 |
| Go | github.com/corazawaf/coraza/v3 | < 3.3.3 | 3.3.3 | GHSA-q9f5-625g-xm39 |
| Go | github.com/jptosso/coraza-waf | < 3.3.3 | 3.3.3 | GHSA-q9f5-625g-xm39 |
| Go | github.com/jptosso/coraza-waf | all versions | — | GO-2025-3537 |
Advisories 1
- openSUSE-SU-2025:14937-1 govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026